crowdsecurity/crowdsec · error

MedianInterval expects a slice of times

Error message

MedianInterval expects a slice of times

What it means

Type guard in MedianInterval: the single argument is neither []time.Time nor []interface{} of time.Time values, so there is nothing to compute intervals from (e.g. a string or number was passed from the expr expression).

Source

Thrown at pkg/exprhelpers/helpers.go:725

	}

	var times []time.Time

	// Handle both []time.Time and []interface{} (from expr map function)
	switch v := params[0].(type) {
	case []time.Time:
		times = v
	case []interface{}:
		times = make([]time.Time, len(v))
		for i, item := range v {
			t, ok := item.(time.Time)
			if !ok {
				return 0, fmt.Errorf("element at index %d is not a time.Time", i)
			}
			times[i] = t
		}
	default:
		return 0, errors.New("MedianInterval expects a slice of times")
	}

	if len(times) < 2 {
		return 0, errors.New("need at least two times to calculate a median")
	}

	// Sort times
	sort.Slice(times, func(i, j int) bool {
		return times[i].Before(times[j])
	})

	// Compute intervals
	intervals := make([]time.Duration, len(times)-1)
	for i := 1; i < len(times); i++ {
		intervals[i-1] = times[i].Sub(times[i-1])
	}

	// Sort intervals for median calculation

View on GitHub (pinned to 909b515798)

Solutions

1. Pass a slice of time.Time values, typically from EvtInt marshaling in the scenario
2. Ensure the source event field actually contains parsed timestamps, not strings

When it happens

Trigger: Thrown at pkg/exprhelpers/helpers.go:725 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4751f16de77b0235. Report an issue: GitHub.